CISA Urges SharePoint Hardening After New Exploitations
Update July 16, 2026 : CISA has updated this Alert to reflect the addition of CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) Catalog on July 16, 2026. CISA is aware of active exploitation of vulnerabilities CVE-2026-32201 , CVE-2026-45659 , CVE-2026-56164 , and CVE-2026-58644 , enabling cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities,
Read at CISA Cybersecurity Advisories
- Vendor
- Microsoft
- Product
- SharePoint
- EPSS
- 0.43 (p99)
- Exploitation
- observed in the wild
- Exposure class
- Collaboration
Why it ranks 64 (High)
- Exploitation observed in the wild
- EPSS 0.43 (elevated)
- Product class: collaboration
- Widely deployed vendor product (Microsoft)
- Covered by 6 independent sources
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA Cybersecurity Advisories (cisa.gov)
- CVE-2026-32201 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-45659 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-56164 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-55040 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-58644 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.